Translation status

128 Strings 100%
Browse Translate
3,331 Words 100%
24,646 Characters 100%

Strings status

Strings Words Characters
128 3,331 24,646
All strings Browse Translate Zen
128 3,331 24,646
Translated strings Browse Translate Zen

Overview

Project website www.linuxfromscratch.org
Translation process
  • Translations can be made directly.
  • Translation suggestions can be made.
  • Any authenticated user can contribute.
  • The translation uses bilingual files.
Source code repository git@git.linuxfromscratch.org:fr-lfs
Repository branch 12.0
Last remote commit Add Portuguese (Brazil) BLFS 5a031b636f
Julien Lepiller authored 7 months ago
Last commit in Weblate Translated using Weblate (Portuguese (Brazil)) 73d7bab260
User avatar jamenson authored 5 months ago
Weblate repository https://translate.linuxfromscratch.org/git/linux-from-scratch-12-0/index/
File mask blfs/*/postlfs/security/iptables.po
Translation file Download blfs/pt_BR/postlfs/security/iptables.po
Last change May 17, 2024, 12:14 a.m.
Last author None
2 weeks ago

String statistics

Strings percent Hosted strings Words percent Hosted words Characters percent Hosted characters
Total 128 3,331 24,646
Translated 100% 128 100% 3,331 100% 24,646
Needs editing 0% 0 0% 0 0% 0
Read-only 0% 0 0% 0 0% 0
Failing checks 0% 0 0% 0 0% 0
Strings with suggestions 0% 0 0% 0 0% 0
Untranslated strings 0% 0 0% 0 0% 0
Last 12 months Previous

Activity in last 12 months

0 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes 135 changes 0 changes 1 change 0 changes 6 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes
Nov Dec Jan Feb Mar Apr May Jun Jul Aug Sep Oct

Quick numbers

3,331
Hosted words
128
Hosted strings
100%
Translated
0
Contributors
and previous 30 days

Trends of last 30 days

—
Hosted words
+100%
—
Hosted strings
+100%
—
Translated
+100%
—
Contributors
—
User avatar None

Changes committed
Changes committed 5 months ago
User avatar jamenson

Translation changed
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Begin rc.iptables

echo
echo "You're using the example configuration for a setup of a firewall"
echo "from Beyond Linux From Scratch."
echo "This example is far from being complete, it is only meant"
echo "to be a reference."
echo "Firewall security is a complex issue, that exceeds the scope"
echo "of the configuration rules below."
echo "You can find additional information"
echo "about firewalls in Chapter 4 of the BLFS book."
echo "https://www.&lfs-domainname;/blfs"
echo

# Insert iptables modules (not needed if built into the kernel).

modprobe nf_conntrack
modprobe nf_conntrack_ftp
modprobe xt_conntrack
modprobe xt_LOG
modprobe xt_state

# Enable broadcast echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route

# Enable TCP SYN Cookie Protection
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptance
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects

# Don't send Redirect Messages
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Drop Spoofed Packets coming in on an interface where responses
# would result in the reply going out a different interface.
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Log packets with impossible addresses.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians

# Be verbose on dynamic ip-addresses (not needed in case of static IP)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# Disable Explicit Congestion Notification
# Too many routers are still ignorant
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Set a known state
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# These lines are here in case rules are already in place and the
# script is ever rerun on the fly. We want to remove all rules and
# pre-existing user defined chains before we implement new rules.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Allow local connections
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow forwarding if the initiated on the intranet
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT

# Do masquerading
# (not needed if intranet is not using private ip-addresses)
iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE

# Log everything for debugging
# (last of all rules, but before policy rules)
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT "

# Enable IP Forwarding
echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Início do rc.iptables

echo
echo "Você está usando a configuração de exemplo para uma configuração de um firewall"
echo "oriunda do Beyond Linux From Scratch."
echo "Este exemplo está longe de ser completo; ele é entendido para ser"
echo "somente uma referência."
echo "A segurança do firewall é um problema complexo, que excede o escopo"
echo "das regras de configuração abaixo."
echo "Você pode encontrar informação adicional"
echo "acerca de firewalls no Capítulo 4 do livro BLFS."
echo "https://www.&lfs-domainname;/blfs"
echo

# Insere módulos do iptables (não necessário se construído internamente
# ao kernel).

modprobe nf_conntrack
modprobe nf_conntrack_ftp
modprobe xt_conntrack
modprobe xt_LOG
modprobe xt_state

# Habilita difusão echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Desabilita Pacotes Fonte Roteados
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route

# Habilita a Proteção SYN Cookie do TCP
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Desabilita a Aceitação de Redireção de ICMP
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects

# Não envia Mensagens de Redireção
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Descarta Pacotes Falsificados entrantes em uma interface, onde as
# respostas resultariam na resposta indo para uma interface diferente.
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Registra pacotes com endereços impossíveis.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians

# Seja verboso a respeito de endereços de IP dinâmicos de IP (não necessário
# no caso de IP estático)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# Desabilita a Notificação Explícita de Congestão
# roteadores demais ainda são ignorantes
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Configura um estado conhecido
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Estas linhas estão aqui no caso das regras já estiverem no lugar e o
# script for mesmo
# reexecutado em tempo real. Nós queremos remover
# todas as regras e cadeias preexistentes
# definidas por usuário(a)
# antes de implementarmos novas regras.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Permite conexões locais
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Permite o encaminhamento se a iniciada na intranet
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT

# Faz o mascaramento (não necessário se a intranet não estiver usando
# endereços IP privados)
iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE

# Registra tudo para depuração (última de todas as regras, porém antes
# das regras de política)
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT "

# Habilita o Encaminhamento de IP
echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
5 months ago
User avatar jamenson

Translation changed
<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts

cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Begin /etc/systemd/scripts/iptables

# Insert connection-tracking modules
# (not needed if built into the kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Enable broadcast echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Enable TCP SYN Cookie Protection
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptance
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Do not send Redirect Messages
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Drop Spoofed Packets coming in on an interface, where responses
# would result in the reply going out a different interface.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Log packets with impossible addresses.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# be verbose on dynamic ip-addresses (not needed in case of static IP)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# disable Explicit Congestion Notification
# too many routers are still ignorant
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Set a known state
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# These lines are here in case rules are already in place and the
# script is ever rerun on the fly. We want to remove all rules and
# pre-existing user defined chains before we implement new rules.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Allow local-only connections
iptables -A INPUT -i lo -j ACCEPT

# Free output on any interface to any ip for any service
# (equal to -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permit answers on already established connections
# and permit new connections related to established ones
# (e.g. port mode ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Log everything else.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# End /etc/systemd/scripts/iptables</literal>
EOF
chmod 700 /etc/systemd/scripts/iptables</userinput>
<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts

cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Início do /etc/systemd/scripts/iptables

# Insere módulos de rastreamento de conexão (não necessário se
# construído internamente ao kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Habilita difusão echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Desabilita Pacotes Fonte Roteados
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Habilita a Proteção SYN Cookie do TCP
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Desabilita a Aceitação de Redireção de ICMP
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Não envia Mensagens de Redireção
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Descarta Pacotes Falsificados entrantes em uma interface, onde as
# respostas resultariam na resposta indo para uma interface diferente.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Registra pacotes com endereços impossíveis.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# Seja verboso a respeitocerca de endereços de IP dinâmicos de IP (não necessário
# no caso de IP estático)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# Desabilita a Notificação Explícita de Congestão
# roteadores demais ainda são ignorantes
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Configura um estado conhecido
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Estas linhas estão aqui no caso das regras já estiverem no lugar e o
# script for mesmo
# reexecutado em tempo real. Nós queremos remover
# todas as regras e cadeias preexistentes
# definidas por usuário(a)
# antes de implementarmos novas regras.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Permite conexões locais somente
iptables -A INPUT -i lo -j ACCEPT

# Libera a saída gerada em qualquer interface para qualquer IP para
# qualquer serviço (igual a -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permite respostas em conexões já estabelecidas e permite novas
# conexões relacionadas às estabelecidas (por exemplo, modo de porta
# ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Registra tudo o mais.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# Fim do /etc/systemd/scripts/iptables</literal>
EOF
chmod 700 /etc/systemd/scripts/iptables</userinput>
5 months ago
User avatar None

Changes committed
Changes committed 5 months ago
User avatar jamenson

Translation completed
Translation completed 5 months ago
User avatar jamenson

Translation changed
<xref linkend="libpcap"/> (required for BPF compiler or nfsynproxy support), <ulink url="https://github.com/tadamdam/bpf-utils">bpf-utils</ulink> (required for Berkeley Packet Filter support), <ulink url="https://netfilter.org/projects/libnfnetlink/">libnfnetlink</ulink> (required for connlabel support), <ulink url="https://netfilter.org/projects/libnetfilter_conntrack/">libnetfilter_conntrack</ulink> (required for connlabel support), and <ulink url="https://netfilter.org/projects/nftables/">nftables</ulink>
<xref linkend="libpcap"/> (exigido para suporte ao compilador BPF ou nfsynproxy), <ulink url="https://github.com/tadamdam/bpf-utils">bpf-utils</ulink> (exigido para suporte ao Berkeley Packet Filter), <ulink url="https://netfilter.org/projects/libnfnetlink/">libnfnetlink</ulink> (exigido para suporte ao connlabel), <ulink url="https://netfilter.org/projects/libnetfilter_conntrack/">libnetfilter_conntrack</ulink> (exigido para suporte ao connlabel) e <ulink url="https://netfilter.org/projects/nftables/">nftables</ulink>
5 months ago
User avatar None

Changes committed
Changes committed 7 months ago
User avatar jamenson

Translation changed
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Begin rc.iptables

# Insert connection-tracking modules
# (not needed if built into the kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Enable broadcast echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Enable TCP SYN Cookie Protection
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptance
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Do not send Redirect Messages
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Drop Spoofed Packets coming in on an interface, where responses
# would result in the reply going out a different interface.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Log packets with impossible addresses.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# be verbose on dynamic ip-addresses (not needed in case of static IP)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# disable Explicit Congestion Notification
# too many routers are still ignorant
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Set a known state
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# These lines are here in case rules are already in place and the
# script is ever rerun on the fly. We want to remove all rules and
# pre-existing user defined chains before we implement new rules.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Allow local-only connections
iptables -A INPUT -i lo -j ACCEPT

# Free output on any interface to any ip for any service
# (equal to -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permit answers on already established connections
# and permit new connections related to established ones
# (e.g. port mode ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Drop any incoming MULTICAST or BROADCAST packet before logging:
# The box outputs several of them when using netbios or mDNS, and those
# appear immediately as incoming, which clutters the log.
iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP

# Log everything else.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# End $rc_base/rc.iptables</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Início do rc.iptables

# Insere módulos de rastreamento de conexão
# (não necessário se construído internamente ao kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Habilita difusão echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Desabilita Pacotes Fonte Roteados
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Habilita a Proteção SYN Cookie do TCP
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Desabilita a Aceitação de Redireção de ICMP
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Não envia Mensagens de Redireção
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Descarta Pacotes Falsificados entrantes em uma interface, onde as
# respostas resultariam na resposta indo para uma interface diferente.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Registra pacotes com endereços impossíveis.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# Seja detalhado acerca de endereços de IP dinâmicos (não necessário no caso de IP estático)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# Desabilita a Notificação Explícita de Congestão
# roteadores demais ainda são ignorantes
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Configura um estado conhecido
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Estas linhas estão aqui no caso das regras já estiverem no lugar e o
# scriptconjunto de comandos sequenciais for até mesmo
# reexecutado em tempo real. Nós queremos remover
# todas as regras e cadeias preexistentes definidas por usuário(a)
# antes de implementarmos novas regras.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Permite conexões locais somente
iptables -A INPUT -i lo -j ACCEPT

# Libera a saída gerada em qualquer interface para qualquer IP para
# qualquer serviço (igual a -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permite respostas em conexões já estabelecidas e permite novas
# conexões relacionadas às estabelecidas (por exemplo, modo de porta
# ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Descarte qualquer pacote MULTICAST ou BROADCAST entrante antes de registrar:
# A caixa gera vários deles ao usar netbios ou mDNS e aqueles aparecem imediatamente
# como entrantes, o que sobrecarrega o log.
iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP

# Registra tudo o mais.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# Fim do $rc_base/rc.iptables</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
7 months ago
User avatar jamenson

Translation changed
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Begin rc.iptables

# Insert connection-tracking modules
# (not needed if built into the kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Enable broadcast echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Enable TCP SYN Cookie Protection
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptance
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Do not send Redirect Messages
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Drop Spoofed Packets coming in on an interface, where responses
# would result in the reply going out a different interface.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Log packets with impossible addresses.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# be verbose on dynamic ip-addresses (not needed in case of static IP)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# disable Explicit Congestion Notification
# too many routers are still ignorant
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Set a known state
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# These lines are here in case rules are already in place and the
# script is ever rerun on the fly. We want to remove all rules and
# pre-existing user defined chains before we implement new rules.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Allow local-only connections
iptables -A INPUT -i lo -j ACCEPT

# Free output on any interface to any ip for any service
# (equal to -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permit answers on already established connections
# and permit new connections related to established ones
# (e.g. port mode ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Drop any incoming MULTICAST or BROADCAST packet before logging:
# The box outputs several of them when using netbios or mDNS, and those
# appear immediately as incoming, which clutters the log.
iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP

# Log everything else.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# End $rc_base/rc.iptables</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Início do rc.iptables

# Insere módulos de rastreamento de conexão
# (não necessário se construído internamente ao kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Habilita difusão echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Desabilita Pacotes Fonte Roteados
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Habilita a Proteção SYN Cookie do TCP
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Desabilita a Aceitação de Redireção de ICMP
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Não envia Mensagens de Redireção
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Descarta Pacotes Falsificados entrantes em uma interface, onde as
# respostas resultariam na resposta indo para uma interface diferente.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Registra pacotes com endereços impossíveis.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# Seja verboso a respeitodetalhado acerca de endereços de IP dinâmicos (não necessário
# no caso de IP estático)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# Desabilita a Notificação Explícita de Congestão
# roteadores demais ainda são ignorantes
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Configura um estado conhecido
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Estas linhas estão aqui no caso das regras já estiverem no lugar e o
# script for mesmo reexecutado em tempo real. Nós queremos remover
# todas as regras e cadeias preexistentes definidas por usuário(a)
# antes de implementarmos novas regras.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Permite conexões locais somente
iptables -A INPUT -i lo -j ACCEPT

# Libera a saída gerada em qualquer interface para qualquer IP para
# qualquer serviço (igual a -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permite respostas em conexões já estabelecidas e permite novas
# conexões relacionadas às estabelecidas (por exemplo, modo de porta
# ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Descarte qualquer pacote MULTICAST ou BROADCAST entrante antes de registrar:
# A caixa gera vários deles ao usar netbios ou mDNS e aqueles aparecem imediatamente
# como entrantes, o que sobrecarrega o log.
iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP

# Registra tudo o mais.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# Fim do $rc_base/rc.iptables</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
7 months ago
User avatar jamenson

Translation changed
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Begin rc.iptables

# Insert connection-tracking modules
# (not needed if built into the kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Enable broadcast echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Enable TCP SYN Cookie Protection
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptance
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Do not send Redirect Messages
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Drop Spoofed Packets coming in on an interface, where responses
# would result in the reply going out a different interface.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Log packets with impossible addresses.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# be verbose on dynamic ip-addresses (not needed in case of static IP)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# disable Explicit Congestion Notification
# too many routers are still ignorant
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Set a known state
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# These lines are here in case rules are already in place and the
# script is ever rerun on the fly. We want to remove all rules and
# pre-existing user defined chains before we implement new rules.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Allow local-only connections
iptables -A INPUT -i lo -j ACCEPT

# Free output on any interface to any ip for any service
# (equal to -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permit answers on already established connections
# and permit new connections related to established ones
# (e.g. port mode ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Drop any incoming MULTICAST or BROADCAST packet before logging:
# The box outputs several of them when using netbios or mDNS, and those
# appear immediately as incoming, which clutters the log.
iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP

# Log everything else.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# End $rc_base/rc.iptables</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Início do rc.iptables

# Insere módulos de rastreamento de conexão
# (não necessário se construído internamente ao kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Habilita difusão echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Desabilita Pacotes Fonte Roteados
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Habilita a Proteção SYN Cookie do TCP
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Desabilita a Aceitação de Redireção de ICMP
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Não envia Mensagens de Redireção
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Descarta Pacotes Falsificados entrantes em uma interface, onde as
# respostas resultariam na resposta indo para uma interface diferente.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Registra pacotes com endereços impossíveis.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# Seja verboso a respeito de endereços de IP dinâmicos (não necessário
# no caso de IP estático)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# Desabilita a Notificação Explícita de Congestão
# roteadores demais ainda são ignorantes
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Configura um estado conhecido
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Estas linhas estão aqui no caso das regras já estiverem no lugar e o
# script for mesmo reexecutado em tempo real. Nós queremos remover
# todas as regras e cadeias preexistentes definidas por usuário(a)
# antes de implementarmos novas regras.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Permite conexões locais somente
iptables -A INPUT -i lo -j ACCEPT

# Libera a saída gerada em qualquer interface para qualquer IP para
# qualquer serviço (igual a -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permite respostas em conexões já estabelecidas e permite novas
# conexões relacionadas às estabelecidas (por exemplo, modo de porta
# ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Descarte qualquer pacote MULTICAST ou BROADCAST entrante antes de registrar:
# A caixa gera vários deles ao usar netbios ou mDNS e aqueles aparecem imediatamente
# como entrantes, o que sobrecarrega o log.
iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP

# Registra tudo o mais.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# Fim do $rc_base/rc.iptables</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
7 months ago
Browse all translation changes